VYPR
← All advisories
Medium severity5.4NVD Advisory· Published Jun 3, 2021· Updated Jun 17, 2026

CVE-2021-3469

CVE-2021-3469

Description

Foreman versions before 2.3.4 and before 2.4.0 is affected by an improper authorization handling flaw. An authenticated attacker can impersonate the foreman-proxy if product enable the Puppet Certificate authority (CA) to sign certificate requests that have subject alternative names (SANs). Foreman do not enable SANs by default and allow-authorization-extensions is set to false unless user change /etc/puppetlabs/puppetserver/conf.d/ca.conf configuration explicitly.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

3
  • Theforeman/Foreman3 versions
    cpe:2.3:a:theforeman:foreman:*:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:a:theforeman:foreman:*:*:*:*:*:*:*:*range: <2.3.4
    • (no CPE)range: <2.3.4, <2.4.0
    • (no CPE)range: foreman 2.3.4, foreman 2.4.0

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.